The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by delegating tasks to local workers via the pi_spawn, pi_steer, and pi_continue tools. The primary ingestion point for untrusted data is the task parameter in these tool calls. While the instructions (SKILL.md) mandate supervisor oversight and objective boundary definition, there is a risk that malicious user-supplied instructions could be interpolated into these tasks, potentially misleading the worker into performing unauthorized actions.
[COMMAND_EXECUTION]: According to the documentation in references/mcp-contract.md, the implement worker profile provides access to bash for running tests, builds, and shell-based verification. Although the skill instructions emphasize that the supervisor must retain all risk decisions and verify results, this capability represents a significant attack surface if the agent is influenced by malicious task instructions.
[EXTERNAL_DOWNLOADS]: The reference material (references/mcp-contract.md) describes how to install the @zguiyang/pi-task-exec package from a public registry. This resource is owned by the skill's author (zguiyang) and represents expected functionality for this skill's ecosystem. The skill explicitly instructs the agent not to auto-install the package or run the launch command directly, which is a positive safety constraint.

pi-delegate